UNC!...ASSin£D//I-O0O// 

a. Docs 'he sysiem/prpjeei support criminal. CT, or FC1 •ovesliganons or 
arv^omem'N 


YES i If yes, proceed to question 7>1 

b.. Are subjects or ioforraation from whom toe mfonnstsors is doeeny coneemo 
provided a veriuen PrNacv Act (c)(3) statement (odher on toe eehecuon form or via s. 

x, NY >**H urN ♦«* oork ;\ | I U' oAm cm oupNtm m 

the accessary form(s).| 

YES Identify cay feraiy paper' or electronic, used to requaN amah 

i >, i«! 5 £ m m is r 1 o 0 w t 

7. Are Social Security Numbers (SSNs) collected, maintained or disseminated from the 
svs!.c.m/prc>iect? Fad SSNs should oaiy be used as kU:augers or suuaca mstauces, 

NO \ t ti M's. dn<A Ai that 

SSNs arc important for other reasons. Ikserihe: 

__ The sy Aero/project provides special protection to SSNs (c g. ; do Ns arc 
encrypted,, hidden Nora ah mors via a look-ap took or very axammie a> eeroms 
users) Describe;: 

It is riot feasible for the system/project to provme spec::a; emmaam m 
SSNs, Explain: 

.No, 

Yes, Information systems operated by contractors tor Etc FBI may be ^ 
considered privacy Act systems of records. The federal Acquisition Regulation 

i V i D^D A D INN m 
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UNC L ASSIf IED//FO iJO// 

imposed a.s a matter of .Department of Justice policy, Cormhtadons with the 
system for the FBI, 


Has die system undergoes Certification & Aecrednuiion (C&A; by me r Bt 
S eo or i ;.y DI viHo n (S ec .0) 

NO If nm indicate reason: if €XA is pending, provide anticipated 
c o m ps 1 e 1.1 o n it a t e: 


X YES If yes* please indicate the following, if ksewn; 

Provide dote of hist CNYA c«rtificstian./re-eeriiHeetH>5ii; 

CernDdenifodiy:_'Low_Moderate _X_!:iigh.Undefined 

I o tegrify: Low Mintende _LsHieimed 

Avrdfshlbiy: Low _X_Moderate .High „ JJndetmed 

Hoi aepHCiible - ON system is only paper-based, 

) for QWr | | 






Does lbs system conduct data mining as defined tit Section H,4 ot me^ 
Implementing Reoonunendmkms or the 0 1. t Com mission wet of. eUO >■, do,, ; i v 
S3'moddied at 42 USC ICRfoeeC}? 


YES If ves, please describe the date mining fonetkn: 

..HO ... YES 

UHa,ASSILI.El)YfOEO// 
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i \n i> hho 


Status Of System/ Proj ecu: 


\.'. o' n ^ \ ’>* - e* ( <u u \ AyiUs'u ;h ><m vm*.ko! '«* vk 

STOP. The £TA is now complete, and after (iivwkm approvals:} shook! be 
submitted to FBI OGC/f CLII for final FBI approval ami determination if 
PI A aad/or other actions are required*) 
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I V'! N k 


H, I'V'HVx i'AOdO'ix 

I. When was the system/no Act developed? April 200$ 

NO :ifno. proceed to next question (iffy j 


YES If yes, indicate which of the iotiowing changes were involved (mark an 
rkmges that snob, and provide hnef vxphmathm dm each meHad change- e 

A conversion from paper-based records to an electronic system 


A change from mformaiion in a format that is anonymous or non- 
identifiable to a format that is identifiable to particular individuals. 

A new ess of an IT systerwprokeh including apphe alien of a new 
teebnoiop, that changes how in format ion hi identifiable term is noma gad 
Pi:-or examme. a change that would create a more ||||.n. enwroamem emwor 
avenue lot exposure of dak that previously did not exist.) 

A change shat results in information in identifiable Ann heme 
merged. centra; iced, or foakbed with other databsecs. 




. A o' > e 


e of informadoc in 


A chaouo vhw results m new items ot .imorrwuwn m Kientumwe 
form being added into the ayslemArokct. 

Changes do not involve a change m foe type ot recorcs twa.mr.ane 
the individuals ma whom records ate maintained, or the use or 
dissemination of information from the systam/pro-ect. 

Other [Provide brief explmmkm 1: 


CAT: LASSIFIEB/fFO'OO// 
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<■ i > •'fit <. V sSC O, ' v > N I'll 

s- Hi 0* *' s‘* I \ Cor toud CM apHro'u} ,nid <knrrrom:sUon s' FI \ ,snt; or other 
ortiosrs are required, j 


epic.org 


EPIC-14-06-04-FBI-FOIA-20150616-7th-Production 


EPIC-2167 










FBI PRIVACY THRESHOLD ANALYSIS (PTA) 

V' >Kx»m ' ' „ X s s\Nss 


DthR I ID * mans W> ^ - < 


I s ¥ si i:' m/p itoj i.'.cr roc 

V- I I 


FBI ODC/ PCLD POP 
Name: Avid 

^>» d l ~ 


I ^\1 


lornher: JEH. 





Program Manager {or other appropriate 
executive as Division determines) 

.0 i v is i on Ff ivacy 0fEto 

Programs Division: 

Date signed: 

Name: 

" . _ * ' 

Signature: 
Dare .signet 
Name: 

: 

: ADD"/ A ^ 

1 

"S SeCUrUV VOVCiiAiiS! 

FBfMQ Division: 

Crimson: lusnee 
hhossiXitiOn Services i 

Division 

V i/Mfig.X 

N - s,! X A 

i Came: Avis C. Bsssher 
i Thle: Acting N K.'S Set:tiers Chief 

Signature: 
Date si ones 

N^t= 


b6 

b7C 


b6 

b7C 


\ V * ' N S \ N > Vs 'mu’ s s ‘ , s » < « v l l *■ ! \ l > M 
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tJNCX re re pi;LAI’O h €|II- >:I %L i nF LY 

H\ G FBI APPROVAL / DETEMMIYATIOYS/ C 0\miK»N> 


X P'lA k required by the B-Govemme?it Acre 

f v \ f\ to 'V ;VO "\U\ ' t ' iX's d v s\ 0 

1 'ShKi'' m fPuG\t u iAVl'K'U uha s \ \re 


Pi A >\ no- required for the following reaso«(s): 

'revOU V \\ \0 S\ In ' «V !' 

K v S- <v X K v. U K v f v V ' s S' 

_____ ms or am boo so me reremm re sere m si sores; ereereimsu opessoS' ■ re 

_\re cv brer been os re > \ \ assessed asider an evaluation v r to a I v 

\ s ' ' ' k \ v . s ' v x x- on re re i.v 

Other 


\ ' tB\ Oo ' q ‘re skj \ lore hs v \_\ \NOu-ouh X t ns UK <■ s 

" US' A 'u i 'X h 'U I ii t\ lo . *s^ . o s "Oil 

s \\ VAi re s v. 1 u ' \ N ’re I s re t\ v' \ 1 i re o ■> e 

tore ' \ \'\i ' s. -vs V < K I V V V V vJ A 


Prepare Aevisemdd Privacy Act {Ore l statements lor related iwsrssP N o 


RECORDS.. The program should css surest with RMD to idesAityreerebre assy Federal recordsmieottoaie seenum :wsues. 
The \ Isr p; cosstaln Federal records whether or riot H contains Privacy Act requests tmd, irs assy event a records 

OKitSsIv.' vOWvOcd Ov "K Sa'is' re. \Y v v k a sOre ore rerev re;re . re S£vO|IY v HAD s ft*' w re . 't re 
1 ^ v jv " <. sv v s v_ v re re > i. N * v y v Kv 5 v re - C s ; v v y\are tsqdsUy 


Privacy and Civil Liberties Unit 


| Signature: 

I Date Slam 


' ;k\ v ' ,0.0x1. Dsgtrtv Genera; Cotsnaei SiU5tats.srt 

FBI Privacy amt Civil. Officer Date Sic; 
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L INFORMATION ABOUT 11 IF SYSTEM / PROJECT 


.!> Provide a general description of the system or project that includes;' (a) name of 
the sysiero/projeeh including associated acronyms; (h) structure of the 
syslenUprojeey mdmh.og tntereonueedons with other projeOs or systems; (e) 
purpose of the system/projeei; t'd) nature of the ioinrnration io the system/projeei 
and how it will he used; (e) svho will hove access to the information in the 
systetn/projeet; tt) and the manner of transmission to oil users. 


The National instant Criminal Background Che-.k System (NICS) is currently 



Index, and. thru non-US citmen. the hUonttahon systems maintained by die United States 
Immigration and Customs Bn!brccrne.rst in the Department of Homeland Security to 
determine whether prospective firearm purchasers or drear-o permit applicants are 
dissueiihod from reteivis-g firearms or associated permits. The UK'S is attended to 
provide the Federal Firearms Licensees tTPLsi with art immediate determination as to 
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A. Is under indictment for, or has been convicted in any court of, a crime 
punishable by imprisonment for a term exceeding one year; 

B, la a fugitive from justice; 

€.. Is an unlawful user of, or addicted to, any controlled substance; 

I) Han been 'adjudicated as a ''menial detective'" or has beers committed-to a 
mental institution: 

5 is an alien who is 1 egally or unlawfully in the United States or who has 
been admitted to the United States under a nonimmigrant 

F. Mas beers discharged frpnf the Armed. Farces under dishonorable 
conditions;. 

Cl Having been a citizen of the United States, has renounced such citizenship; 

n Is subject to & conn order that restrains the person from harassing, stalking, 
or threatening an intimate partner or child of such, intimate partner (issued 
after a hearing of which actual notice was received}; 

I. Htss been convicted in any court of a misdemeanor crime of domestic 
violence (which has as an element of the offense the ruse or attempted use 
of physical force, or the threatened use of a deadly weapon, committed by 
a current or former spouse, parent, or guardian of the victim or by a person 
with a similar relationship with the victim); 

J. h otherwise disqualified from possessing a firearm under state law; 

K. Is or claims to be an PFL, i.e., a person licensed by the ATP, as a 
manufacturer, dealer, or importer of firearms, or an authorized 
representative or contact person of an FT 1 

L„ Has applied for the transfer of a firearm ora llrearms-reiaied permit or 
license and has had his or her name forwarded to the NILS as part of a 
request for a NICE background check, an appeal, or other inquiry 
regarding a NICE transaction, (Identifying information may he 
maintained for those individuals who have requested the reason for a 
denial or delay .tram the FBI or from a law enforcement, agency serving as 
a Point of Contact (POL), and/or who have challenged the accuracy or 
validity of a disqualifying record or otherwise inquired about a M ICE 
transaction. These files may also include names and other information on 
other individuals pertinent to such inquiry or appeal.); 

M Has provided the FBI with written consent, to maintain infonreulon about 
himself or herself In the Voluntary Appeal File (VAF); or 

N. Has been granted relief from a firearms or explosivev-related disability 
and/or granted a pardon, (For example, in order to permit faster 
evaluation and approval of future transactions, the NICE may maintain 
information on individuals who have been granted relief by the ATF from 
firearm disabilities, as well as information on individuals who have been 
granted Presidential pardons. > 

" fofon- eon Apf ey-ordsstem n he \K n mo> l ,\,vN 

3) the Appeals Management Database (AMD); 4) the Voluntary Appeal Hie 

he .FPL File; 6) the Automatic Call Distribution (ACD) System and Fax 


EPIC-14-06-04-FBI-FOIA-20150616-7th-Prodiiction 


EPIC-2295 











I V'l \S\ir8'|V H>KOm< f \* USE ONLY 


prospective transferee, the type of transaction (inquiry or response), time and date of 

! vfUi X v ! v- \0 > V * ! ' > <. ke t i i A 11 1 

mqulry/reaponse data •• such as , NICS Transaction Number C\ 1N, a unique number 
assigned to each valid background request inquiry ), and information found by the NICS 
search. NICS transactions that result > a proceed response also contain the same 
information but exist only lor less than 24 hours from the time that the response is 
communicated to the It because proceed transactions must be purged of ail identifying 
information submitted by or on behalf of the transferee, All that remains in the Audit. 

Log is the NTN assigned to the transaction, the date and time of the transaction, status. 
Stale of purchase, purpose code, he nobikation fete source, and the PFL identification 
number. Within 90 days (usually by day 88) from the issuance of a proceed decision, a 
second purge occurs and the only information that remains in the Audit Log for a proceed 
transaction is the NTN and the date of the transaction. 

Upon written request from the ATI-' containing the name and license number of 
the PFL, the FBI may extract infor.ntal.ion from the NICS Audit Log and create an 
individual ill audit log for transactions originating at the named I F! over a period of 
time. An individual ill audit log. the only copy of which is provided to the \ 1 may 
contain all Information for denied transactions and the NTN, FPL identifier, arid creation 
date and time for cancelled, open, and delayed transactions. With respect to proceed 
transactions, only the NTN and date of Inquiry are retained in the Audit Log. An 
individual FPL audit log may only contain up to 60 days worth of proceed transaction 
transfer records originating at the FPL, Proceed information in the Audit Log may only 
include information not subject to destruction pursuant to a congressional!)’ mandated 
restriction. 

Appeals Management Database (AMP) 

The NICS generates and retains appeal records in the Appeals 'Management 
Database (AMD)." Information in the AMD reflects inquiries by potential transferees 
regarding the reason for a delay r denial by the NICS or a Point of Contact PO state, 
challenges to the accuracy or validity of a disqualifying record, arid other types of 
mquirk'- made h> potemfei Transferees about a NT'S ir.msneoon. \ POt st.de i~ e \ fee 
• ' 'M u ii uni gomes tw s s t u m g to eu t ? s u , A 

federal databases cheeked by the NICS. A POC state receives NICS 'background cheek 
requests from Ills cheeks state or local record systems, performs NICS inquiries, 
determines whether matching records provide information demonstrating that an 
individual is disqualified from possessing a firearm under Federal or state law. and 
responds to .PfLs with the results of a NICS background cheek. A POC state is a state 
agency with express or implied authority to perform POC duties pursuant to state statute, 
regulation, or executive order. Full POC states perform the firearm background checks 
Fa it nsS wtened mfe t s ?<, 1 artia } f \ Mates re h n 5 °">o ms cheeks for 

handgun permits or transfers within the state and the FBI performs the checks for long 
guns. The ATP queries the NICS tor Information that helps ATT determine whether to 


1 fix; AMD h separate from the Voluntary Appeals File smee they have different functions amt re-eohno 
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issue explosives permits and licenses and for its investigations in connection with the 

The N!CS must destroy identifying information submitted by or on behalf of any 
person who has been determined not to be prohibited from receiving a firearm no more 
than 24 hours after the system advises an FPL that the transfer would not violate the 
Brady Act , If a potential purchaser is delayed or denied a firearm and successfully 
appeals the decision, the NIC'S cannot retain the record of the appeal or the supporting 
doeunvntau-'n O'! in ore l i a O dm > tunkss the ffoltotb o) s mainbtfoed as ion o> rise 


Voluntary Appeal File (VAF) 

Because of the purge requirement, individuals who wish to make subsequent 
purchases may be delayed or denied again until their record has been re-reviewed or until 
the individual has appealed the denial. In order to present future imnecess.mr dda> s or 
erroneous denials, individuals, who arc potential transferees, may request that the NICS 
maintain Information about them in a Voluntary Appeal File (VAF)/’ The VAF ts a fUe 
that will be cluxked b> the Mu'S for delayed transactions v-hen the potent d mc-wtlvec 
provides his or her unique personal identification number t'UPLN). Only information 
about lawful potential transferees is kept in the VAF; if an individual \ found not to be a 
lawful transferee, his/her information is. not maintained as pail of VAF. 

The VAF permits individuals to voluntarily submit personal identifying 
information for the limited purpose of clarifying existing records or proving identity to 
facilitate future transactions. Potential transferees have the option to request that the 
NICS maintain personally identifying information about them in the VAF that would 
if., w \e Pc ‘ ei<fyeb m t Alex 1 dosmou>> t u\w tc ode ot s$ ) *t 1 n i J to 
fingerprint cards, photographs, court documentation, correspondence, and information 
•contained, in the applicant's appeal tike if one exists, if fingerprint cards are submitted, 
they must be prepared by a law enforcement agency that must stamp the agency's name, 
address, and telephone number in. the designated area of the fingerprint card. As of May 
2010, ail VAF records entering the die are kept only in electronic format and archived 
V.aF records are being converted to electronic format, 

FFL File 

)*, x h x v. tot a i o >. o i ? na trowsdt cbp%,yM ribysv 
ATF to he FFLs, This information is provided by the ATF from the FFL. application and 
includes the FFL's name., codeword,'' address, phone number(s), the ATF number, names 


' A RA for she VAF was con-pMed it; January 2006, 

>, v ''Ofp' l ^_U.Mwva,)> > )i Ft,i <, , { - <. k 


" A eodewowi e «jve by k- FFi. when dealing with the call center nr with a NICS Section employee on the 
phone. The codeword - also used by an FFL when conducting a check: on the E-Check system: the FFL 
has to have both the codeword and a passwntd i order to gain access to E-Cheek. See r \ page. 
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of authorised representatives and contact persons, and similar information used by the 
Nit'S to identify, validate, and communicate with FFLs a the course of NICS operations. 

ACD System and Fax Server 

Two computer systems monitor for audit purposes telephonic and tax 
transmissions made into ami out of the NIC'S during system operations - the ACD 
System and the Fax Server. The ACD System operates as a call-routing -mechanism that 
analyzes information on calls referred from the contracted call centers to the NICS 
Section and directs customer service calls to the most appropriate NICS customer service 
representative. The ACD System records and retains the incoming phone call and 
associated data, such as the incoming phone number, the NICS Section employee who 
answered the call, and the date and time of the incoming call The Fax Server operates its 
a similar fashion. When a NICS Section employee faxes a request tor information, his ot¬ 
her out-going fax transmission contains a control number that identifies the NICS sender. 
The reply tax transmission will also contain that control number. The Fax Server 
automatically directs the return tax transmission to the appropriate sending NICS Section 
vp!} \ v 11 e v '“v \ \ 1 5 v u hv 1 , i k n i\ ,< \ k \ v \ 

control number,. the NICS fax number, and the number of the incoming taxes among, 
other related sv.'.t'Okv. data 

E-Cheek 

The majority of NICS cheeks are initiated by FFI.s via the telephone. The. PFL 
contacts the NICS and conveys the information to a NICS Customer Service 
Representative (CSR). The CSR validates the \ FI., by obtaining the FPL’s license 
number and an assigned codeword. Once validation is complete, the FFL transmits 
information supplied by the firearm purchaser on the ATP Form 4473. The CSR enters 
the information transmitted by the FFL. into a computer terminal and initiates the 
background check. Hash employee of the FFL uses the same codeword when contacting 
the NICS via the telephone. 

The NICS E-Check was established to meet the legal requirement imposed to 
provide other electronic means of conducting background checks, in addition to the 
telephone. The NICS E-Check uses a Public Key Infrastructure ( PKI ? technology to 
allow FFLs and their employees to conduct background cheeks via the Internet. Each 
individual user is issued a personal digital certificate which acts as a key to gain access to 
a secure Web page. Once the user gains access, he/she submits the potential firearm 
purchaser's information securely over the Internet to the NIC'S and retrieves the results of 
that e >.k„ <\<t\ vs u i th| : 4 s- i S ~ i i f« omCk vO'u, 
that are willing to abide by certain guidelines outlined in a Memorandum of 
Understanding (MOO) may obtain a single digital certificate per store, instead of one for 
each employee. Following the procedures and responsibilities outlined in that MO-U 
allows an Cl to use one digital certificate per physical. location, thereby minimizing trie 
admmtstr m\e -sethead o! managum ondurk d'gmf, ce- uftemoN I he I- >. • rcrrens.hle 
for proper use of the digital, certificate and is responsible (along with the offending 
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1, User's .Orst, middle, and last, name; 

2. User's .mothers maiden name; 
j. User's e-mail address (optional); 

I User's Date of Birth; 

5, User id Name; 

6. i so? \ telh"\ me Ft 1 inhumation. 

a FPL number, 
b. FFL cudeword. 
c I-FI. .Name of licensee. 

d. bn Nns.oess N<-ak\ 

e. FFI.. address. 

f. FT 1... phone number. 

g. FFI... Fax number, 

h. I FL Contact Name; 


Date and time user applied to the CA; 



The above imormation is used to authenticate the identity of specific users before 
they are permitted to access the NICS through the F.-Check System. As part of the 
Certificate of .Authority process, the FFL seeking to authorise -individuals' to use F.-C'heek 
on. their behalf is required to have its nominated individuals read the FFL Responsibilities 
Information.. The- FFI... is then required to have the authorised individuals fill out and sign 
the acknowledgement that they have read that information before they send it to the NICS 
Section. The NICS Section maintains the acknowledgement and matches it with the 
identities of the users accessing the E-Cheek system in order to assure their identity and 
authorization. 

Disposition Document File (PDF) 

The Disposition Document. File (DDF) contains record information that cannot be 
posted to a subject's criminal history record, in the NCSA updated in the Integrated 
\ Uon me * I u .pi it Idea . c... on<>' -tefov fo t ^ .^mg 1 w > aurivv. 
Records found in. the DDF may include, but are not limited to, arrest dispositions, 
warrants, protection orders, police report'.:, court ordered mental commitments, protection 
orders, and indictments and mlormations (if not already posted to at individual's rap 
sheet). The DDF helps reduce the need for NICS Section personnel and CHS Division 
personnel to contact local and state agencies to obtain information. Some of the 
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information contained in the DDE is data that the Criminal Justice Information Services 
CCJI8 ) Division’s Biometric Services Section (BSS) cannot post. This information may 
be rejected by the BSS for various technical reasons; the dotes of arrest are not filed; a 
federal or military disposition is not able to be posted to a date of arrest submitted by 
state or local contributor; there are disposition records that the FBI docs not control; 
dispositions and charge records have codes that, require translation; a disposition is 
already on file; fingerprints are illegible; information is not able to be related to a specific 
date of arrest; or validation is lacking, such as missing, a state bureau stamp. 

ATF Relief from Disabilities File (RF1>> 

The ATF Relief iron 5 . Disabilities • R.f'D) File is a compilation of applicant 
information obtained by the ATF when it processed firearm and explosives disability 
relief applications Irons 1969 to 1992.' Although Use ATF stripped processing R.PU 
applkeheuN In 'T°T shore records remain relevant to firearm and espies;-, e pu'mk 
checks, are retained by the Ms S and are used to evaluate firearm transactions and 
explosive permit applications. 

The Nl€8 Section employees research the DDF, ATF RFD, and YAF for 
supplemental information that could assist n resolving a delayed firearm or explosive 
transaction. Research of these three databases is undertaken only after a potential 
transferee's information results in a hit against a record In the ill- HOC. \K s Index, or 
U.S. Immigration and Customs Enforcement. The record information in these databases 
may contain information to assist NICS Section employees in quickly determining the 
poienu ' ns eu\ 4 dn m ^ >o ^ \ tm r > ' lo \ P t ui. o 

contact outside agencies. As noted above, the VAF is only searched when the potential 
transferee provides his/her UPLN with the transaction. 

The DDF, the ATF RFD, and the : VAF are accessible to NICS Section employees 
via links on the NIC'S Section employees’ tool bar and are accessible to POO and partial - 
POC states. This enhanced inlormaiion resource helps .foster nationwide consistency in 
firearms and explosives eligibility defenumallons. 

Telephone Conversation Monitoring nod Recording ~ Quality Control Measure 

Currently, there are two occasions during which NICS telephone conversations 
are non e . I - '.'"oomh seL\ . Mes section'* vlceee telephone e r\eiw o td 
the telephone conversations between PkLs and Cali Center CSRs, The NICS Section 
employee telephone recordings arc conducted for purposes of quality assurance and 
NICS management** evaluation of employee performance. These recordings are 
recorded over immediately if there are no adverse findings-by NICS management and 
audit personnel, if there are adverse findings, the recordings are retained until the issue is 
satisfactorily resolved, at which time they are recorded over. The FFL/CSR telephone 
recordings involve firearm transactions and customer service calls, are conducted for 


" The ATF Relkftrom Disabilities fife.Ft act subject to the Brady Act requirement to purge pm 
InfonnsOon CsTsa 24 hoars. 


epic.org 


EPIC-14-06-04-FBI-FOIA-20150616-7ttvProduction 


EPIC-2301 




X. 


Pfyes, pieo-se c<mtimte.f 


3. rica.se indicate if any of the following characteristics apply to the Information in the 
system about individuals. Bear in mind that log-on information may identify or be 
linkable to on individual. 

(Check ah that apply.) 

i n0 irec11 y 1 dent i i y epee i n a i ndi vtd uais 

X The information can be need to distinguish or trace an individual’s identity the., it 
it linked or linkable in specific individuals). 

if yon marked any of the above, proceed to Qeesthm 4 

None of the above, if none of the above, describe why the mtbrreaiion does not 

consultants? 

X_ NO YbS 


5 is intbnnation about United States citizens or lawfully adndfiyd permanent resident 
abcos retrie ved from the aystemnsroleot by name or other personal identifier? 

NO. |lf on, skip to qoesiioe 

.X.YF.S. iff yes, proceed to the nest question.! 

subject of tine in form alio n? 

NO pf no, proceed to question 7,1 
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U N C L A S S DM E I>//F O R OFFKSAL USE ONLY 


_X YES H-Checks, Appeals and the VAP all collect information directly 

from the person who is the subject of the information, 

a. Does the syjdem/projeci support criminal Cl', or PCI investigations o<- 
assessments? 

.NO 

X YES | If yes, proceed to question %\ 

h. Are subjects of information from whom the information is directly collected 
provided a written Privacy Act (e)(3) statement (either on the collection Conn or via a 
separate notice)? 

MO (The program wifi need in work with PC'LU to deve lop/im p fern cut 
the necessary form(s),f 

YES Identify any forms, paper or electronic., used in request such 
Information from the information subject: 

7. Are Social Security Numbers (SSNs} collected, maintained, or disseminated from the 
system/project? Full SSNs should only be used as identifiers in limited instances, 

NO X YDS If yes, cheek all that apply ; 


SSNs are necessary to. establish/confirm the identity of subjects, victims, 
witnesses, or sources in this law enforcement or intelligence activity. 

_SSNs are necessary to identity I Hi personnel in this internal administrative 


X SSNs are important for other reasons, Describes SSNs are not required, 
but are valuable information that,, when, provided, help to estaolish/conlirm the 
identity of individuals in this activity. 

_..._ The system/pmject provides special protection to SSNs (e.g., SSNs are 

encrypted, hidden from all users via a look-up table, or only available to certain 
users). Describe: 

_X.ft is not .feasible for the system/projeef to provide special protection to 

lAplarn, 11 ^ \K'S p% ' ‘ptv , pnns.5 < r to fo <e t;v Infonnau-m it 
maintains, not just SSNs. The information housed in the NIC'S is limited * only 
authorized FBI personnel with a need to know tor their official duties. 
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I; Xi? i\ nSI I 1ill)/ r OR OFFICIAL, i ff only 


8. Is I he system operated by a contractor? 
X No. 


_ Yes. Inlbnoabem systems operated by contractors for the FBI may he 
considered Privacy Act systems of records. I he Federal Acquisition Regulation 
contains standard contract clauses that most fee included in the event the system 
collects, maintains or disseminates PH and additional requirements may be 
imposed as a matter of Department of justice policy. Consultations with the 

! v v v ! m d \ * *s v v v > » » N o •> 

system for the FBI. 

Has the system undergone Certification fee Accreditation (C'feNY} by the PR) 
Secao t y I >i v i si on (Seel 1) > ? 

NO If no, indica te reason; if €AA Is pending, pres ide anticipated 
completion date; 

X YBS If yes, please indicate the following, if known; 

Provide date of last CAA ecriittcatlon/re-eertiflmion; 
levels: 

Confidentiality:_Loss- X Medium_High_Undefined 

ladegrifye I on- Moderate X High Undefined 

AvalloMIify:: I,ovs Moderate X High Undefined 



.10, Is this systetreprojeet the subject of an OMBdOO budget submission? 

..NO 

.X.YBB If yes. please provide the date and name or 

title of the OX! B sub miasma; 

\ s \ " ' N F x , ' ' v * ' 

11. IVO' no^atom om\mo; Jet. mb on,. ?\ Rom fe .a Ammn NN m no 

'mp.emcmom Reommrmvet u the11 t. evmus'Oea \m m' \\ ", p | $ to, 
53'modihed at 12 CPC 2000ev-5 •? 
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CNF.1. A.SSIFIU>//Ffm OFFICIAL LAE ONI. 


NICS is abb to compile Individual audit lop, at ATPs written request, of 
0 \ s oo >I' s 4 a ■>i ? tc \ \v. !\ \k \ 

definition of an < *opetf*' transaction status allows a transaction to be 
it owl so i)l va ! YE -qar ' ' c t andatc o om w 
final transaction determinations to NICS. thus providing additional 
inihrrnabon to NICS, NiCS also operates the VAIS which collects and 
maintains additional Pn, 

A . s ijifi.e foot w.whs >r a new us o -.low Wo tv >» -nfonnatl^n in 
hkoalfl, >b too". 

X_ A change that results in now items of information r identifiable 

form being added h,v the °> stem ptojeo 

Sec owe svp-anatvn tegvdnu uoivOn.d sad torn md \ \F 
infonnatlon. 

\ t n'v de not awoke a clauwu nt the A' ot wvosE ^\> * o 
the individuals on whom records are maintained, or the use or 
dissemination of information from the system/project. 

Other if ms ide brief explanation]; 

.3. Does a FLA for this systeoCproieci already exist? 

.X.NO .YES 

There rs a FI A for the VAP hat not one for the system overall because NICS was 
considered <x gntndfat'he?ed n at the time of passage of the cAlovcrnment Act. 

a f reside date/title of the IT At 

F l,Lw o w^euy> ' , . cfgooVurs •. >r< ic ?! pha^gCN \ netv N\' 


.NO _YES 



determination in earn of .yrm" responses. the NICS continuer researching potealbliy prohibiting 
wxv «k regarding the. mmsferee and, if definitive Information is obtained, communicates to the FF1 the 
oral determination that the chech resulted A a proceed nr a deny. An "open 1 " response sacs net prohibit an 

v ' ' ^ V ' V V- ' V V S V 'N, , V \ ^ t , ^ , VV 

\ ' V \ " VV } vV ' , t< ' V S vKS^ N 
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FBI PRIVACY THRESHOLD ANALYSIS (PTA) 


NAME OF SYSTEM PROJECT New Natio. fnstant Criminal B kgroiss C ck S> s(NICS) 

' ____ 



Lr roqu yq .*. 

Program On sec: New MCb prqsecDJfhce ; 
Do ikon i. oF 1 lb Nmo 

FBI oce/m.F POC 
Name:AGC| I 

Phone :| Zl 

Room Number: JDf 7350 


Phone;l 1 



\ > ' \i ' N ! v. \ ' 



FBI DIVISION INTERMEDIATE APPROVALS 



Program Manager (or other appropriate 
executive as Division determines) 

Division Privacy Officer 

Program Division; 

$ km am re: /Tsmf /)v VOCo t 
'Dam 'g\n '' - 

Name: ?v ■; \ o gege 

Title: m.,vN A-eY 

, | | 

Date signed. 11 //FT NT 

Name: | I 

>' \ V' ' - v N » 

FBI HO Division: 

Criminal Justice 
information Servicer 
(CHS) Division 

Signature; 

DoS: .ngned: 

Name: Paul Wysopal 

Title: NICS Section Chief 

mgnamre: 

Date signed: ; 

Name:| | 

Title: Supervisor Security Specialist 


After all division approvals, forward signed hard copy phis electronic copy to FBI OGC/PCLl/ (JEM 7350), 
(Tee FBI Privacy and Civil Liberties Officers defermmtbns, conditions, and/or final approval will be recorded on 
following page,) 
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MUi u'i 


C. PIA is required by dm i. -Government Ad. 

.PI A is to be completed as a -muter oi PBi/DO.l disv 

Pi A to be pnbhshed on FBI.GOV {after sea RAID IG 


PIA is no; required !•>;' Ac following rea.-omte: 

System does no; coileck mend.dm or disseminate PH. 

System is grand lathered An existence tenors- -tel 7/2003; no later changes pt 
tntbrmdion in dm system relates to mteond government operations. 

.System has been pms hardy assesses; under an evaluation similar to a Pi A. 

.Mo si go ilka nt privacy issues tor privacy tesoet; are unchangedj 

Other: 


Appheabie SORNtsy l)G.bkBh-bky kmmmd loo 


boded backs:roami Chad--. Xyster; 


Notify RBI RYlD/RiDR per MiOG iPO.dd^ X.Ac; .Yes -Sec sample RC ms PCI k mdand. v 

mtp h/hnme. DOAdGC/i.. 1 iCPCia bitehrmyh !vl;%2(>Liberries%c0i.ibrary/form ion mloe:d0-2-3 ec.sv 

SORN/SORN revisimsCb required? .No .Yes . 


Prepare r 


a Add Privacy Ae; I c g .k sk-ternm-te lor related herns? 


Ri CORDS, The program should eonsuh v- Id- k\ID io Identdy/resoive any Federal records eieetrooie records Runes, 
system may contain laxiend records whether or not h commas Privacy Ad requests and. in any even;, a records as.bead 
approved by the National Archives and Records Administration ;s necessary. RAID can provide advice or; tins as red ; 
compliance with requirements ibr electronic Recordkeeping Certification and any necessary updates. 




| | Acting. Uni; Chief 

Privacy and Civil Liberties Cm; 


i Sicnature I- 

; Date Xa.mcd: 


Jacqueline F. Brow; 
FBI Vrivac y ami Cl- 


. Acting Deputy Gene 
d Liberties Officer 


Signed me: , ? 
Date maned 
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!. iNIA>KMATION ABOUT TT1F: SYSTEM / PROJECT 

E Provide o penersl description of the system or project that mehsdes: Ays name of 
the syMons/prefect, including associated scro.oy.ors: {!>} strsctorc of the 
^ s pf'OSvK mCodmg v ^hes ','gi i sssto?^; •, 

purpose of the sysiem/projeet; (d) nature of the oiforoooios fo the system/project 
and how st svdt be used: te) who will hove access to the Information hi the 
systeodprojecl: if) and the manner of transmission to all users. 


Thirpose: The FBI Criminal .fustier Information Services tCJIS) ClviskmN Neo 
iSatkmai Instant Criminal .Background Cheek System tNICS) Project proposes j. 
redesign of the legacy NICS to replace the outdated design and technology oft.be 

approach hv automat in 




b7E 


The NIL'S records ore stored in lire NICS Index, the NICS Audit hog. the 
Vo lust tar y .Appeal Foe (YAP g the Appeals Management Database (AMDs, th 
federal Firearms Licensee {FPL} file, the Autormuie (did Dlskihudon (ACD; 
System. the NILS E-Cheek System, the National ( Vane inrbrmation Venter 


*C 
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e. The Federal Firearms f Tenser File 

the A il-. This irnomukor: Is provided by -he A II Ter: -he Ml. application 
and includes tie: FIT name, codeword. address. phone number- sr ATT 
number, names of authorized representative 0 and contact persons, and similar 


f, V A V s S A X v s V ^v 

Similar In tuner ion to the Audit Foe. two compcler systems monitor 
tdephomc transmissions made into ami out ot the TICS during system 
operations ■■■ the At A) System and she Fax Server. Further descriptions may 



g. The Appeals Management Database (AMII) 


1 he NiCS also generates and retains "appeal records." which reflect inquiries 
by individuals regarding the reason tor a delay or dental by she NICS or a 
Point of Contact {POO state, challenges to the accuracy or validity ora 
dosp.iah A am record, nr other types of inquiries mack- by individuals about a 
NICS transaction. Appeals are received Com the irkiwdnal via F .S. Postal 
Service, facsimile, or e-malt. Appeal records ere retained In the AMI) 
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b7E 


h. Vedenin ry Appeal File (VAF) 

Under Tide 21. Code ;d redera'i Aceniaomss tCFRc. subsection 25. lOigc 
published July 25.. 2004. dec VAF *;;s estahhshed to prevent in tare 
unnecessary delays or erroneous denials. The initial rule pcerrhs kisvAP 
irnnsierees to Ngnest the NICN maintain nuorunnion about themselves l.a a 
VAF. a separate computer tec cheeked by the NiCS when the traestetee 
provides tes or her nniane personal identification number tUPiN}. Further 
description of the VAF is available let the legacy NICS FTA. 


1 IVAI" 

hsiR: amt me on the TICS 1 

|the N 1C S |- 


J b7E 

-- 


1 






the New NIT SI 



b7E 


h The ATF Relte.r From fbsaddbtles Catrdmse (ATFEI>1>) 

The ATFkDD Is a separate database cewseanw ofeenkcam irtl.ortvtat.ioc 
obtained by the ATF daring the ieee it processed applications tor relief from 


Research of the .Aff RCf) is undertaken only a lter the initial subject searcit 
retmhe in a hit against a record In the Hi. the NcIRA the NICS Index, or The 
Immigration arte Customs tnOorecraeai Ck'k) databases. The records in the 
ohTTRDD may contain information that nib assist NlCk la detenumirw the 
i subject's diglblhty to possess a 0rearm and-or explosive' - without has Inn to 
contact ontside agencies. I he A IT ACC -nay also contain, miormahon which 
eoukl imrnedeaeiy resah In. a "proceed" or ' deny'" deNrrmnakem. 

The Reids emtlatned In the ATFRDb mehidc; the subject's mane, social 
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3. Please indieaU; 'if any oi'the Ini losing Cvo aviedsdae aped io Ce rConoaC>n in tee 

i linkable to an individual 
(Check Cl that apply ; 





If'you marked any «f the a hove, proeeed to Covadon 4. 
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X V bS III y os. pr-Orocd to dtC Oost pOosCo:on I 





NO [’The proprsns odd orod to work ndh PC b J Co <!evskpf>/mi|>ie»u:Bf 
tdc nooossory fooons O 

Vbb tdootky soy forms, paper or deemode.. osed to ropocst ruck 
jofermadoe. from On: od'oroodioo subject. 

7. Are Social Secarby Numbers >SS N N.; cdNeood.. nooouered or dioseorouded from the 
ayoienvprpiori? Foil SS'Ns shook! eni) bo mod as deod'Ors ; n boded oroeaeos. 

NO X VIS ;! yos, shook oh that apply: 
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X SS:\s arsonrannlein .Hi i>:hot ream-ns. Describe: SSNs arc not required, 
but arc valuable intonnatHri that. when pros e.kaf heir- to oaiahUsfkc; -niXm she aiemky of 
individuals at His achvity. 

oner s pied, hidden dene ad users Ha a loot.-up tank;, or only available to certain 
arcra •. Describe: 

SS\v be plain:: baf'o provides special protection to af of the information it 



When an ff f cads ai to reencei a d rearm tmnsier naekertnaul chock, the cad is 
initially rceeivssJdd ora; of dove klfS cenurastoo-opcrated cad corners, 1 ioc. 0 - on 

boundary and the blf'S Section approve.' the acbpts fra' of center ot'eratora uao 
when responding a - KFL cabs 1 he (HIK ic those seniors obtain certain rep tided 

automated scorch of the three databases to want whether there is n match. If there 

there Is a hie the traasacnoo is delayed and He Idafs : .ad is iraaateired to a NX'S 



collects, rnaiitanns or sf iwccrosaics HI arid additional ropulrantcnts in ay he 
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X NO If niK lodkate reason: If CAM X pemlkiys provide aotkipated 
eOOSpktiOO <Ok:. 

The New NiCS is sarreraX k; development. CO A Aehvaa.w ere scheduled tor 

Review ;pDR.y (hadeal lAweo Rev;ew tCORa. Rood Rv.wpn Review (f'DRh Test 
Read; ores Review. dPRR}. oed Rysoaa Acceptance Review- (PAR). i>enra: the 
SAK. an accreditation. eackape odd Re waooPted Re Aokonpy to Operate (ATOi 
dec wane ATO wp: peneode and RR and ee a-anvalanpon letter to hRIJ wp; be 
created. 


If yes, please indicate the feAbwdap, R know n: 
ho ps res 

Fro vide data el km f X \ eeri1f;eatle?r/rewave?lfXevRleo;: 


Contidestdahty: 

J...ow .Moderate 

.High 

.I.asdolioed. 

Irkeprd've 

laws- Moderate 

. High 

Codefhsed 

Avadahddv:: 

lews Moderate 

.Hlpp 

Ido tie II red 

. N; X eppheablv this sy.o. 

aw b„n!y papers 

k 


1 rspPemeni: no Ree; not wendorl ; ew 


ae:nfU 

,a dilk p.L 1 


53 (eod.bled at 42 Id SC etlORee-A}' 5 

... ... X( d 

.Yh.S If yes. edease dessOhe the data rtdoktp toosRon; 
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| as encrypted values and are masked from view, except for the Iasi 
four digits. Access to ever, these last four digits of' the SSN s, as well as access to 

]; s restricted to 


all of the records in thej_ 

W ' . ' x v, ». \ >c x " i ^ m ! l ' _ 

i retrieved from the system byf 


1 


grades t 


; user names and pa 
Is with system access and maintains an. audit log. 


[ Enables OTD seeret&t 
3'or review within OTD prior toQ 


1 


1 


v s v ' w no e e c f ' u 'X o' ' n " N . ‘ 

'K tele- names m nx raarias and osdw ideals is t'Uf res too \ s' a, | | 

‘O'" s N ^ s v ’ ' \ v v ! < ! ' V O •< v !N -* «. 

tracks the user names and passwords of all individuals with access and maintains 

' v o v. i n ■- \ n' s ' 


“Iritis application provides a m< 


This application tracks 


J The app lication ntefades names of penpfi 
voiced in | l and vhc | f ntan ager[ 


I Only the names are provided - no other personally Identifiable iniortnaiiovt. 11 
only people with acce ss to these reports are the manager of the | | 

and the OTD | | ma.nager, The application keeps track of the user names and 

"V ' N V V i N <N vN »_t_^_ 

addition, the application keens track of the dates oil 1 

I ~ l - 


~h'ra cks theQ 


Aton tnektdes the names of lab personne 


Hr,. 
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\VN€LA§SWm> 


system can be searched by | | > he wyTeauun kec"\ mwl 

of the user names and passwords of all individuals who have access and keeps an 
audit log. 

2. Poes the system/projeet collect maintain, or disseminate any information about 
imfivldnals (he,, a human being or natural person, regardless of nationality}? 

NO 

X YES |I.f yes, please continue.] 

3. Please Indicate if any of Use following characteristics apply to the information in the 
system about individuals: .Bear m mind that log-on information may identify or he 
linkable man mdi'Jduoi 

(Cheek all that apply.) 

i_X_ The information directly Identities specific individuals. 

S O \ ~ S. \ d \ X ’ >\ ' < ^ > ! s 0 <. \ ' N 

; <\ x „ v s ' \ ' \r n . ex fo . 

‘ v *< e ' a; \e , a x o ^eee, ' . ' x e \ 

is linked or linkable to specific individuals). 

If you marked any of the above, proceed to Question 4. 

\o'v m the aboxo H none of foe ahn v \ oesc' foe n in the mformatfoo Jw.s not 
foeoop joeedfo nvm .deaK „ ;t vs enom\ nvmeub 

4. ! \\x 1 v " \ v ' o o Os woe ' i' \ 's "" ' ^ w Ow\"' vO N s o ' o 
i consultants? 

.X NO .Y138 


5, Is information about United Slates citizens or lawfully admitted permanent resident 
aliens retrieved from the system/project. by name or other personal identifier? 

NO. f'lfno, skip to question 7.] 

.X.YES.. (If yes, proceed to the next question.) 

6. Does the system/prqieet collect any information directly from the person who is the 
subject of the information? 

..NO (If no, proceed to questum 7.j 


mcLAmnm 
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% V I XV I h 


X.YES 


a, Does the system/project support criminal. Cl'., or FO Investigations or 

.OV'SVOeOSS.'' 

.X.NO 

YES pf yes. proceed to question T.| 

X , » * N X X 1 ? v > i. vv vx X 

<' < x o N o \ x ^ s o . > or 

separate notice}? 

X NO {The program will need to work with PCLU to 
dev elop/implement the necessary form(s)d 

The FBI has a Privacy Act (e)(3) notice regarding audit logs that is visible on user login 
screens. In addition, the FBI provides FBI Information. Technology and information 

N ' ' I O 'x X O , . x, ! ^x .x i 1 O ' 't fo „x 

V V ' f vX . V . O V ^ ' 

developing an (eh?) notice that can be provided to | | 

.Y.ES identify auy forms, paper or electronic, used to mfnest such 

information from the information subject: 

?. X 0 Vs \\ \ V\\s „ , ss ' v \ , x '>'>«. V.S O' 

' ' V S SS 'S X > < < \ X \ S * S N ' ' X Ns- 

NO X YES If yes, cheek nil that apply: 


.X.SSNs are necessary to esi&blisb/eontirm the identity of subjects, victims., 

'\une^e-' or soun.es m tb-s foxx enforcement o? mtolhno tee aem its 


"'sXsmowcs ax m «";o ‘'*vo <• \ m < a, ' s , x 


.SSNs are important for caber reasons. Describe: 

\ . sx ,m "d„ -'v motom <" O' "V ■■ 

c m ' ' v 1 O' mV' '< \ , ' ', ' m ' I X v. 

users). Describe: 


IfoYXAVIihtCB 
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SSNs are encrypted. The majority el l l asers see only the last four digits 
of a SSN. SSNs may be viewed by a small number of FBI personnel who 
most | 

it is not .feasible for the system/project to provide special protection to 
SSNs. Explain; 

Is the system operated by a contractor? 

X No, 

' , \ O 'S'. ' V ' v. ' N * ' ^ X 

is n oc s ' x >s' ''Ci ocv Cv*' O' v!vN‘ \s v lo\' o> 

contains standard contract clauses foal must be included in the event the system 
collects, maintains or disseminates PI1 and additional requirements rnav be 
" v si*' m ^ - '\r o ^ ^ vc o > n " X '< '< 

S'^V'.S S V. 1. V 

system for the FBI. 

Has the system undergone Certification & Accreditation (C&A) by ibe FBI 
Security Division (Seel)}? 

NO If.no, indicate reason; if'€&.4 is pending, provide anticipated 
completion date: 

X YES If yes, please indicate the following, if known; 

Provide date of last C&A certifkation/re-eeriificotkm; 
duly 29,2010 

Confidentiality;.Low.Moderate X High.Undefined 

Integrity; X Low Moderate High Undefined 

Availability; X Low Moderate High Undefined 

\ ' N V ' V ‘ W v \ I K ' f \ ' V ' 

is this systeui/project the subject of an OMB-30O budget submission? 

X.NO 

.YES If yes, please provide the date and name or 

title of the OMB submission; 


t r NC;i,ASSii'it::i> 
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] i. Does the system conduct data raining as defined in Section $04 of the 

' ' v\ v ''uo w v" s' cs i \" U" '' v h °' 

'' OsW'Ec? St -fo ' Oi 

YES If yes, please describe the data raining functions: 

\ 2. is this a national security system (as determined by the SecD V? 

.X.NO .YES 

1.3. V . s.' W t" vs"n 'Y \\\ 

This is a 'new system/ project in development. 


| II. EXISTING SYSTEMS / PROJECTS 

1. When was the system/project developed? 109$ 

2. s' C'. ' <\ o f o v. w s y' ss 1 yw - e V '' ' 

i . N() [If no, proceed to next question (iL3U 

[.X.YES 


Oemgc'- to the svaem -one-. Yu) hav e general A ixvn server upgrades, npdracs m 
s v. t ! > | | fhat did 

noisy raw only cb rage t'"o . olT. imn m. mmovKc or own* 'u\U\u os' 
"s'vruY oV" K c'Xc:o "eoojtn Y wera" era" ra* v . \ c"a mo sm- 
oceurred. 

if yes, indicate which of the following changes were involved (murk all changes that 
apply, and provide hrief explanation for each marked change): 

.X. A conversion from paper- based records to an electronic system . 

OS'. u '< ' w w \ | | 

A change from Inlormatron in a format that is anonymous or non- 

t. .. s ' O < S s 's' s < 

A new use of an IT systemforoject including application of a new 

vCs "s O ' ' ' s'S ' O ' , ) ' S. t s s • < , 

s' S S C s ' „V ' S S S ' \ S" 'V' s'* ' 

avenue for exposure of data that previously did not exist.) 
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' ^ 5 * W S " < ' O' Vv ' ' V O ' X 

\s a' 'O' o> " , 'C> ! U ,' o, Ov\\i" vs 

\ OCXs nvfo'O 0''aui VKfVMtU'O iiO Us^ 'U Oi'J amO's to 
A ' 'a ' J> A* - o > m bx v k A 

A systematic incorporation of databases c>f Information in 
identifiable form purchased to obtained .from commercial or public sources. 

A new interagency use or shared agency function that results in 

s". ' C\vO ' Os * * ' iO \'0 " '\,\,vO0 "" 

A change that results in a new use or disclosure of Information in 
identifiable form. 

A. change that results in new items of information in identifiable 
tone \"$y added Into du s\e\.m moK-t 

Changes do not involve a change in the type of records maintained, 

f s vfs ' XO f s. o d , ' 5 ■< o u W x 

so' » n ' * ' o " * e o' ''c sx' e" * .. 

Other (Provide brief explanation j: 

3. Does a FLA for this sysiem/proiect already exist? 

.X.NO .YES 

'OS \ ' IS n ' I'r O' O'v, YV' "Ws 

.m' , v,, om ‘X m\ to" a 

a. .Provide date/tiile of the PI A; 

b. Has the system/profeel undergone any significant changes since the Pi.A? 

.NO YES 
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\ to ho published on FB.FGOV softer any RMP FOIA s'odaeSawso? Vos. .No : 


_ PsA is sso? rooufto-i tor she fsdlovvsssg reasors(s):: 

System?: does sso; coftoo;, a-aastab?. or dsssesamate Pis. 

.System is gsandratoered (is cxis-cnee before 4/i 7/2003; no hum changes? po 

X Oft as messes; a; sac syssesrs sek;?es to sslensa: govesssraersi: operations. 

'v sioit: ftar bees; ps'evsossiy assessed sesder a:? evaUsailon sftnilarto a PiA. 
No significant privacy is^t-es (orrsnvaey Ns-ses are ssnehassgcd). 

Other: 


Appiscabie SOR'N(s); NwdeObBbOsPsXNro.w /vr.'.orom/ora:/ 1 Rnnrgvmro; .Ao/og. Jus: iced BROOK. DUJ i 
Syiie'T.s i.md Aaii-isy taro do; ess /tomoN. DO.j-{)02 


'Notify FBI RMD/RiOS pet MKXs 190.2.37 X.No .Yes-See sample PC os; PQ.C sairaaci website 

hitp:Chospe/OOo';xX'/|yri‘C;X;!a.S;dodvacyCiv;i%;;ftjL;boriiesAt2Pi .shta;-y: : ft;r;y ior asiog 190-2-3 ee.wpd 

SORN/SORN reviasorsts; regonrsO X.No .Yes : 


sftvpare revise;add Privacy Act (c); 3; ssaternenss tor rehued fbrssss': 


RFCORDS. the p-mgra-t; sis-aid consult. old? RNH.) to ide-'tsiiy/sesoive a so Fedesai reco-bs/eiecsro.-ne records sw-so 1 he 
xys-est; may cotstaia Federal records whether or not i? contains Privacy Ac; tvquests arid, as any evens, a records sehedsde 
approved by she Nasiossai .Archives assd Records Adsnisnstration is sseecssasy. BMP use provide advice os; Ussy as wed as on 
•compliance wssb teqairesnessts Cor Flecironie Reoos'dkeepasg CesdFcadoss and assy sseeessas'y updates. 


Other: 


I V. V V. 

Privacy and Civil i.hhextses i issit 


b IgnnUsre 
Date Nigs?: 


■jjuii 


Briar? F. Binney. Acsiag Deputy Geaersd Cousssei 
FBI Privacy assd Civil Liberties Officer 


Signature: 

.Date Signed: 
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L IM'OKM\UO\ * Ml* M 1*«0»K I 


1 , Provide a general description of' She system or project that Includes: (a) .aame of 
the system/project, including associated acronyms; (b) structure of the 
j system/project, including fohmmnnmkms with other projects or systems; (c) 
propose of the system/projm; (dj oaf ore of the ktfortmttkm l.o the mtem/projeet 
laud how ft wilt he used; (e) who will have access to the krtormation m the 
systeo.r/projeet; (f) ami the jammer of transmission to ail users. 


The Information Technology B ranch's (TIB) irapte.mematkm of the | | 

1 | whl fulfil! an immediate need in modernize and expedite 

s s sN s O \ v v b7E 

primary technology tool | | which will deliver access 

improvement solutions io all employees no matter where they are located., providing 
"one-stop shopping" for user access .needs. 

The overall objective of | | is io provide an enterprise level identity management b7E 

solution tor the FBI. To address this complex endeavor, the ITB has developed an 
.incremental strategy that involves the execution of individual task orders. The initial task 
order will establish a. foundational identity management framework to support the 
capability to provlsion/de-provision basic access privileges with future task orders 
focusing on the more advanced Features of identity management on the main FBI network 
(FBJNFT). 'The FBI plans to execute additional task orders to implement the advanced 
capabilities over the next couple of years pending availability of funding. Additional 
privacy documentation will be prepared as .necessary. 

In the initial task order] | 

| | " ^ 

mainframe pa ssword reset functionality. Before ] | mam.ftamc password reset was a b7E 
I I mnnnai process perfonned by the Enterprise Operations Center (FOCI) or the 

V s ^ \ N ' V s ' ^ ' X ' 

I I will function as an enterprise system and be available on FBINet. I J 

focuses the provisioning'' and demrovisfonfo g f | b7E 

| | for ail employees arid contractors wh en they 

0 ' v V ' s v v Os s N X 0 □ 

I I ' s s ' ' s' ' s s or sN 

Provisioning, dc-provisioning, and name changes will be triggered automatically based 

O V 's' s \ s X \ X ' s N 

authoritative source of employee and contractor information). 


I_I b7E 

;; Orovisioniag is tne process ei giving indwidwiis son or sddsnowd sac- to i Bs systems 
■' De-provisini; b the process of removing, access mm; indwmmiis who have eum:r moved wkhi;; ihe i B; 
sad so kmgei need amen: or they hsve let; the FBI. 
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In the future, business unit owners or infonnahon Technology Specialists (ITS) personnel 
may have role-based authority to enter and approve certain requests. For example, upon 
an employee' s transfer or assumption of a ness rol e within the FBI (‘'Mover"'), 
supervisors or ITS personnel may be able to use a | | to enter this request, b7E 

which would automate the processes to 'move' the user's access as wed as create art 
auditable work how. In addition, ail users wilt eventually be able to utbFe a self-service 
interface to request access to desired applications and specific software packages, and 
subsequently track the status of their requests online. 

| | is complete and has delivered a self-service Mainframe Password Reset b7E 

functionality and provisioning a user to the core 11 system components on the main 
PBIMet. 

1 I bulids on the. technical capabilities delivered hs | | 

| \ . ' e \ s o \ ■within the F BiMet to provide a | I b7E 

C apable of provisioning new user accounts, and de-provisioning user accounts for 
employees or contractors leaving the Bureau. 

This PI A covers ! l iAutoikmahty. including the deployment of: 

4 If Headquarters (l ore 'hhuawLeaver 

4 Field Office 'Joiner/!, eaver (to Include Name Changes mtptemetmition 

5 'Mover' imnletnentahon at Headquarters and Field Office 

4 Subsu mption of the exi sting ! I itmctlo-tahty Into the b7E 

I | \ •' n | | . e' ' O' 

InfVastrueture support 
4 Application Management 
Business Process Coordination 

* installation and Configuration oi l I withln the COOP Virtual 

.environment, 

A limited amount of Personally Identifiable Information. (PH) will be needed by | | ln 
order to correlate a proposed user w ith his/her digital identity m the d esired I T 
application or system. Pill continued in the BPMS wtii he imported to □ o facilitate 
processing access requests. PH contained in | [ includes the user's name. FBI unique 
identifying number, and social security number ISSNwinch is the universal identifier in b7E 

' B \ O V ' 0 N - \ s s\ -. N V 

proposed user's name, no other PH will he visible to the individual approving the request. 

Further, other than that approving aut hority, no other users of the system will he able to 
see any PI I relating to any other nscr. | ~| user semens will ran. display user SSNs, 


' Joiner Uavw ss a u-nn awe by ha ! | mOea ter -he ewv yrevkseHra:. end de-pew wlenlny dm occurs 
when a user enters and exits the Bureau's nknhtt eccayssesr 
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